CVE-2026-80311: WP Full Pay Authorization Bypass Vulnerability

CVE-2026-80311 Overview

CVE-2026-80311 is a broken access control vulnerability [CWE-639] in the Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.5. The plugin fails to verify that a subscription belongs to the customer bound to the requesting customer-portal session before processing a cancellation request. An authenticated user with a valid portal session can cancel subscriptions belonging to other customers. Exploitation requires knowledge of the target subscription identifier, which is high-entropy and not enumerable through the plugin.

Critical Impact
An attacker with an active customer-portal session can cancel arbitrary subscriptions belonging to unrelated customers, disrupting recurring payments and service delivery.

Affected Products

Stripe Payment Forms by WP Full Pay WordPress plugin, all versions before 8.5.5
WordPress sites using the plugin's Stripe customer-portal feature
Merchants relying on the plugin for subscription lifecycle management

Discovery Timeline

2026-08-29 - CVE-2026-80311 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-80311

Vulnerability Analysis

The flaw is an Insecure Direct Object Reference (IDOR) in the plugin's customer-portal subscription cancellation endpoint. The endpoint accepts a subscription identifier from the request and issues a cancellation call to Stripe. It does not confirm that the subscription belongs to the customer associated with the active portal session. Any authenticated user with a confirmed portal session can therefore target subscription identifiers other than their own.

The issue is scoped by the attacker's need to know the target Stripe subscription ID (sub_...), which is high-entropy and not exposed by the plugin's interfaces. This constraint reduces practical exploitability but does not eliminate risk. Subscription identifiers can leak through emails, invoices, exported records, support tickets, or compromised third-party integrations.

Root Cause

The root cause is missing authorization on the subscription cancellation handler. The plugin authenticates the portal session and processes the requested action but never compares the target subscription's owning customer against the session's bound customer. This maps directly to CWE-639: Authorization Bypass Through User-Controlled Key.

Attack Vector

Exploitation requires an attacker to establish a legitimate customer-portal session on the target site and submit a cancellation request referencing a subscription identifier owned by another customer. The server-side handler executes the cancellation without ownership validation. No elevated privileges, user interaction from the victim, or additional authentication factors are required.

No verified proof-of-concept code is publicly available. Refer to the WPScan Vulnerability Report for advisory details.

Detection Methods for CVE-2026-80311

Indicators of Compromise

Stripe webhook events (customer.subscription.deleted or customer.subscription.updated with cancel_at_period_end=true) that do not correlate with cancellation actions initiated by the subscription's owning customer.
Access log entries showing POST requests to the plugin's customer-portal cancellation endpoint from a session whose bound customer differs from the target subscription's customer.
Customer complaints about unexpected subscription cancellations on the WordPress site.

Detection Strategies

Correlate WordPress access logs with Stripe API and webhook logs to identify cancellation actions where the session-bound customer does not match the subscription owner.
Alert on spikes in subscription cancellation volume, particularly cancellations originating from a small number of client IP addresses or sessions.
Inspect the plugin's cancellation handler for requests carrying subscription IDs that were never issued to, or displayed for, the requesting customer.

Monitoring Recommendations

Ingest WordPress, plugin, and Stripe webhook telemetry into a centralized log platform for cross-source correlation.
Track per-session action histories and flag any cancellation where the target subscription's customer field differs from the session's customer.
Monitor for unusual authenticated portal activity, such as many cancellation attempts across distinct subscription IDs from one session.

How to Mitigate CVE-2026-80311

Immediate Actions Required

Update the Stripe Payment Forms by WP Full Pay WordPress plugin to version 8.5.5 or later on all affected sites.
Audit Stripe subscription events for the past several months and identify cancellations that lack a corresponding legitimate customer action.
Restore or reinstate any subscriptions confirmed to have been cancelled without owner consent and notify affected customers.

Patch Information

The vendor addressed CVE-2026-80311 in version 8.5.5 by enforcing an ownership check that validates the target subscription belongs to the customer bound to the active portal session before invoking cancellation. See the WPScan Vulnerability Report for advisory references.

Workarounds

Disable the plugin's customer-portal cancellation functionality until version 8.5.5 is deployed if patching is delayed.
Restrict access to the customer-portal endpoints using web application firewall rules that require additional server-side ownership verification.
Tighten Stripe webhook processing to require explicit confirmation from the owning customer before finalizing cancellations initiated through the plugin.

bash

# Verify installed plugin version via WP-CLI and update to the fixed release
wp plugin get stripe-payments --field=version
wp plugin update stripe-payments --version=8.5.5